Unrecognized IP in attack protection allowlists

title: Unrecognized IP in attack protection allowlists
id: 5b7a6b8c-6e3b-11f0-a54c-723487b9527e
status: experimental
description: |
    Detect when new IPs are added into any attack protection allowlist.
    Since allowlists suspend some controls, they should be closely monitored for unrecognized IPs.
    A threat actor can try to add a malicious IP in order to bypass attack protection features.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
references:
    - https://auth0.com/docs/secure/attack-protection
    - https://auth0.com/docs/secure/attack-protection/playbooks
    - https://auth0.com/docs/api/management/v2/attack-protection/patch-suspicious-ip-throttling
detection:
    selection:
        data.type: sapi
        data.description:
            - Update Brute-force settings
            - Create or update the anomaly detection captcha
            - Update Suspicious IP Throttling settings
    filter:
        data.request.body.allowlist:
            - '192.0.2.0/24' # An example. Provide a list of allowed IPs or CIDRs.
    condition: selection and not filter
explanation: >
    The query checks for log entries that modify settings related to brute-force protection, bot detection, or suspicious IP throttling.
    It collects allowed IPs from the request body and compares them with the pre-defined list of allowed IPs.
    The Splunk detection is based on the assumption that the recognized IP addresses are maintained in an external file.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=sapi
    data.description IN ("Update Brute-force settings", "Create or update the anomaly detection captcha",
    "Update Suspicious IP Throttling settings")
    | fields data.details.request.body.allowlist{}
    | stats values(data.details.request.body.allowlist{}) as allowed_ips
    | mvexpand allowed_ips
    | lookup {your-csv-file-with-recognized-ips} ip_address AS allowed_ips OUTPUT ip_address as is_known_ip
    | where isnull(is_known_ip)
    | dedup allowed_ips
    ```Display the information in a table```
    | stats values(allowed_ips) as ips_not_in_csv
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name and the file name containing recognized IPs,
        i.e. IPs allowed to be excluded from the Attack protection features.
tenant_logs: |
    type:"sapi" AND (description: "Create or update the anomaly detection captcha"
    OR description: "Update Brute-force settings"
    OR description: "Update Suspicious IP Throttling settings")
prevention:
    - Control tenant admins, i.e. "Admin", as this role has permissions to modify any application.
    - Enforce MFA for tenant admins to reduce the risk of an adversary gaining access.
    - Control Management API scopes that allow modification of attack protection features - update:attack_protection.
    - Control usage of Management API from only trusted IPs by applying Network ACL scoped to "management".
falsepositives:
    - Legitimate updates by an administrator. This rule is designed for threat hunting and to be a starting point for further investigation.
      It is expected to be correlated with a list of known/trusted IPs.
level: medium
tags:
    - attack.defense-evasion
    - attack.t1562
    - attack.t1562.007
    - detection.threat-hunting